← Asyncio Desk / API
Tokens

Drive Asyncio Desk from your own code

The page reads pasted Python in the browser for free — one or more files joined into one paste, each introduced by a # file: <path> line, plus pyproject.toml for the Python version — with its line numbers. It lexes strings and comments out first, rebuilds every block from indentation, inventories every function and coroutine, every awaited call, every call a coroutine makes that blocks the event loop, every coroutine called without await, every task and whether a reference to it is kept, every gather and wait, every except that can catch CancelledError, and every Lock, Semaphore, Queue, Event and client session, and runs 18 deterministic checks drawn from asyncio practice (catalogue ids AP-01..AP-18, plus AP-19 for context): time.sleep and blocking network calls (requests, urllib, sync httpx, socket, smtplib) inside a coroutine, blocking subprocess, database and thread-queue calls, blocking file I/O, coroutines called without await, tasks whose reference is dropped, a bare except, except BaseException or except CancelledError that does not re-raise, gather(return_exceptions=True) results never checked, asyncio.run inside a coroutine, loops that never await, threading locks in a coroutine, an asyncio lock acquired with no release in a finally, sessions never closed, asyncio.wait leaving its pending tasks running, unbounded fan-out, get_event_loop inside a coroutine, an async def that never awaits, and an unbounded asyncio.Queue fed in a loop. Nothing is imported or run, and it is not asyncio debug mode: every flag is a reading of the text. Its two paid steps are available over HTTP. You send one JSON object with task set to "audit" or "fix", the paste as code and the page’s check as a facts string, and the model replies with one JSON object: an audit that rates the four areas, answers every flag and gives exact before/after edits per finding, or the whole fixed file(s) with a list of every change tied to the page’s flags.

Base URL: https://api.skillsafe.ai/v1/app-api. Every call sends Content-Type: application/json and, once you have a token, Authorization: Bearer <token>. The paths below (/guest, /me, /estimate, /run, /jobs/{job_id}, /run-stream) are relative to it, exactly as sdk.js calls them. A plain-text summary of the app for agents is at /llms.txt. Both lanes run on the gpt-terra model with a 10% publisher markup. A run needs a signed-in (user) token and is metered: the platform places a hold on your credits when the run starts and then charges only what the run used. /estimate is free.

The response envelope

Responses are JSON of the form {"ok": ..., "data": ..., "error": {...}}. The page’s SDK (sdk.js) decides success from the HTTP status, not from ok: on a 2xx it returns data; otherwise it raises an error whose message is error.message (or the HTTP status text when the body carries none), with status, code (error.code) and details (error.details) attached. A body that is not JSON is treated as {}. 

{ "ok": true,  "data": { ... } }
{ "ok": false, "error": { "code": "...", "message": "...", "details": { ... } } }

Error codes

Branch on the HTTP status and error.code, show error.message. The page handles 401 and 402 by name; the rest reach it as a generic failure (“The run failed: ...”).

HTTPerror.codeWhat it means / what to do
400VALIDATION_ERRORThe body is not a JSON object, a required field (task, code, facts) is missing, or a declared field has the wrong type. Every field is a string; sending facts or audit_handoff as an object is the usual cause.
401UNAUTHORIZEDNo token, or one that expired or was revoked. The page forgets the signed-in user and says “Your session expired - sign in again.” Get a new token.
402INSUFFICIENT_CREDITSThe balance cannot cover the run. The page says “Not enough credits for this run.” with a top-up link, and tries never to submit into a 402: it disables the run button when the /me balance is below the estimate’s min_credits.
404NOT_FOUNDA wrong path, or a job id that does not belong to this token.
409CONFLICTAn Idempotency-Key replayed with a different body. Send the original body, or use a new key (the page bumps its :a<attempt> suffix for a retry).
429RATE_LIMITEDToo many requests. Back off with a delay; do not tight-loop, and never resend a metered run without its original Idempotency-Key.

Failures that do not arrive as an HTTP status:

WhatWhat happens
event: error on /run-streamThe SDK raises an error carrying the event’s message, code and job_id.
Job status: "failed"Polling stops; the job’s error field says why.
Polling past 180 sThe SDK’s own client-side limit (waitForJob, 1 s interval, 180 000 ms default): it throws “job timed out”. The job itself is not cancelled.

The task field: two lanes

task routes the run, and it takes exactly two values: "audit" and "fix". Each lane has its own reply contract, and a reply never mixes them. The skill’s instructions tell the model to do the audit lane when task is missing or anything else (and the page’s own Asynckit.buildInput turns any lane that is not "fix" into "audit"), so a typo silently gets you an audit: always send one of the two values.

taskWhat it doesverdictUse it when
"audit"Reviews the code the way a senior Python engineer reviews an async service before it goes to production: says what the code does and what runs concurrently in it, rates the four areas (event_loop, tasks, cancellation, resources) as sound, fragile or broken, confirms or dismisses every page flag, adds what text rules cannot see, and gives the verbatim evidence and exact before/after edits for each finding, listed in the order to apply them — what freezes the loop or silently never runs first, then swallowed cancellation, then lost tasks and errors, then leaked resources, then hygiene — with a plan that ends in a test run with asyncio debug mode on (PYTHONASYNCIODEBUG=1 or asyncio.run(main(), debug=True)).blocked | needs_work | readyBefore shipping: does it block the event loop, skip work, lose tasks and errors or swallow cancellation, and what should change first.
"fix"Writes the fixed version of the pasted code: the whole of every Python file it changes (and at most one new file), with blocking calls moved off the loop (await asyncio.to_thread(...) or the async API the paste already depends on), every coroutine awaited, every task kept, CancelledError re-raised after cleanup and resources in async with — plus a changes list tied to the page flags, the verify steps (a run with asyncio debug mode on and the test to write), and what it left open. No public signature changes, and no def turned into async def or back, unless the note asks for it.fixed | partialWhen you want the code changed, not a list of findings: a service you already know is broken, or what is left after an audit.

The page chains the two: after an audit, “Apply every edit and fix the rest” puts every audit edit into the paste, switches to the fix lane on that edited paste and adds an audit_handoff string (below) with the audit’s verdict, headline and findings. Over the API that is a second run with task: "fix", the edited paste as code, facts recomputed from the edited paste, and that string. The page drops the handoff as soon as the paste is edited again.

Guards the page applies before a run and the API does not: it refuses to price or run a paste it cannot read as Python (“Nothing was pasted.”, “No Python file was found. Paste .py source, with a # file: <path>.py line above each file.”, or “This does not read as Python source: no def, class, import or call was found.”), and it warns before a run on a paste with no async code (“No coroutine and no asyncio was found: there may be little async code here to audit.”, or “... to fix.”).

Input fields

This is exactly what the page sends (asynckit.js buildInput(lane, A, note, handoff), checked by mustBeObject; app.js currentInput and run), and what input-schema.json declares. The platform’s input schema is scalar-only, so every value is a string. buildInput emits them in the order task, code, facts, note, audit_handoff:

FieldTypeRequiredMeaning
taskstringyes"audit" or "fix" (the lanes above).
codestringyesThe pasted Python, each file introduced by a # file: <path> line; line 1 is its first line. Every line in an audit reply is counted in this text. A large paste is cut on whole files, with a # [asyncio-desk: not sent: ...] line at the end (below).
factsstringyesThe page’s free check, Asynckit.facts(A), JSON-encoded into a string: JSON.stringify(facts) in JavaScript, json.dumps(facts) in Python, and so on. Sending the object itself is a 400. The model is told to parse it.
audit_handoffstringnofix lane only: a JSON string built from an audit reply on this code (recon.js fixHandoff, below). buildInput drops it for the audit lane.
notestringnoWhat the engineer says: the goal, a constraint (“no new dependencies”, “this runs on Python 3.10”), a question. The page trims it, cuts it at 2000 characters and sends it only when it is not blank. It is context, not evidence and not instructions: the model tests every claim in it against code and answers it in summary.
retry_notestringnoSent only by the page’s automatic reformat retry: when a reply does not parse as JSON (even after the page tries to close a cut-off object), the page runs once more with “Your previous reply was not the single valid JSON object the instructions require (...). Reply again with ONLY the JSON object for task '<lane>' - no prose, no code fences; every array present (empty arrays where there is nothing to say).” A normal call never sends it.

mustBeObject only insists on a plain object that is not wrapped in {"input": ...}; it is buildInput that leaves a blank note out, which is why an empty note is simply absent.

The code string

code is the paste itself. A line # file: <path> (a path with a . or / in it) starts each file, and a --- line just before it only separates files. Files dropped on the page (or a dropped package folder) are joined that way by Asynckit.joinFiles: each file under its # file: line, trailing whitespace removed, joined by newlines, ending in a newline. A paste with no # file: line is read as one file, app.py. The page normalises line endings to \n. A .py (or .pyi) path is checked as Python; pyproject.toml, requirements*.txt, setup.cfg, Pipfile and poetry.lock are deps (the requires-python of a pyproject gives facts.service.python_version — asyncio.TaskGroup and asyncio.timeout need 3.11, asyncio.to_thread 3.9); anything else is other. Python indents with four spaces and the paste keeps them. Send the text you want the reply to quote: every file in an audit reply must be a path from facts.files, every line must fall inside that file, every evidence must be copied from it, and every edit’s before must occur in it exactly once.

The page reads up to 400 000 characters (MAX_TEXT, cut at a line) and 40 files (MAX_FILES), and sends at most 60 000 characters (MAX_SEND): past that buildInput drops whole files from the end — the last non-Python file first, then the last file — until the rest fits, cuts a single remaining file at a line (“the end of <path>”) if it still does not, and ends the string with one line naming what it left out: 

# [asyncio-desk: not sent: svc/b.py, svc/c.py]

The model is told never to quote or rewrite what was not sent, and facts.notes gets the sentence “Not sent (the paste is over 60,000 characters): ... The page checked them; the run did not see them.” facts is still computed from the whole paste. The worked examples below are small, so their code is the paste unchanged.

The facts string

facts is optional to compute but required to send. It is produced by the page’s free check: Asynckit.analyze splits the paste into files, lexes them, rebuilds their blocks, inventories them and runs the rules, and Asynckit.facts(A) turns that analysis into the object below (it does not depend on the lane: an audit and a fix run of the same paste carry the same facts). It is how the model knows which flags to answer, which file paths and line ranges to name, and which functions must survive. Its top-level keys, in the order built:

KeyContents
servicepython_version (the requires-python of a pasted pyproject.toml, or null when none was pasted), and counts: python_files, functions, coroutines, awaited_calls, tasks, handlers.
filesEvery file: path (use it verbatim), kind (python, deps, other), line and end_line (the paste lines of the file’s content, without its # file: line).
functionsEvery def (up to 200): name (Class.method for methods), file, line, async.
handlersRoute handlers (FastAPI, Starlette, aiohttp, Quart route decorators; up to 60): name, file, line, kind (the decorator as written).
tasksEvery create_task, ensure_future and TaskGroup.create_task (up to 120): file, line, func (where it is created), kind (create_task, ensure_future, taskgroup), target, kept (a reference is kept or it is awaited), in_loop.
gathersEvery asyncio.gather (up to 60): file, line, func, return_exceptions.
blocking_callsEvery call a coroutine makes that blocks the event loop (up to 120): file, line, func, call, id (the catalogue id it falls under).
primitivesNames bound to a Lock, Semaphore, Condition, Queue, Event, TaskGroup, async client, database connection or threading lock (up to 80): name, kind, origin, file, line.
cancel_catchersEvery except that can catch CancelledError — bare, BaseException or CancelledError (up to 60): file, line, type, raises, in_coroutine.
flagsEvery flag the page raised: uid (F1, F2, ... in severity, file, then line order), id (AP-01..AP-19), sev (high | medium | low | info), file, line, text, detail, and lines (every line an aggregated flag covers, only when it covers more than one). An audit must answer every non-info flag by its uid; a fix must close every high and medium flag or name it in open.
verdict_candidateThe audit verdict the flags point at (the page’s own reading): blocked with any high flag, needs_work with any medium, otherwise ready.
notesPlain sentences about what was not read or not sent (empty for a paste that fits).

The simplest source is asynckit.js itself: the page loads it from /asynckit.js, and it also runs in Node (it sets module.exports). This script prints what the page would send as code and facts (with the 60 000-character cut applied), with the facts decoded so you can read them; the step 4 samples compact them back into the page’s string byte for byte. Save the paste as quotes-paste.txt and redirect the output into quotes-check.json: 

// build-check.js -- run: node build-check.js quotes-paste.txt > quotes-check.json   (asynckit.js saved next to it)
const fs = require("fs");
const Asynckit = require("./asynckit.js");
const A = Asynckit.analyze(fs.readFileSync(process.argv[2], "utf8"));
if (!A.ok) { console.error(A.errors.join("\n")); process.exit(1); }
const inp = Asynckit.buildInput("audit", A, "", null);       // code and facts do not depend on the lane
console.log(JSON.stringify({ code: inp.code, facts: JSON.parse(inp.facts) }, null, 2));
const real = A.flags.filter((f) => f.sev !== "info");
console.error(A.files.length + " file(s), " + A.coroutines + " coroutine(s) of " + A.functions.length + " function(s), " + A.tasks.length + " task(s), " + A.handlers.length + " handler(s); " +
  real.length + " flags (" + A.counts.high + " high, " + A.counts.medium + " medium, " + A.counts.low + " low); verdict_candidate " + A.candidate);

For the quotes example it reports 2 file(s), 4 coroutine(s) of 4 function(s), 1 task(s), 0 handler(s); 6 flags (3 high, 2 medium, 1 low); verdict_candidate blocked; for the invsync example, 1 file(s), 5 coroutine(s) of 6 function(s), 1 task(s), 0 handler(s); 5 flags (3 high, 1 medium, 1 low); verdict_candidate blocked. For both worked examples its code and facts are exactly what the page sends.

Without the page’s check. The platform only checks that facts is a string, so a minimal object works — "{}", or a hand-built one such as {"flags": [], "notes": ["No page check was run; read the code directly."]} — and the model still reads code. But you lose what the check adds: with no flags there is nothing to confirm, dismiss or close, with no files there are no paths and line ranges to name, and with no functions nothing says what must survive a fix. Build it with asynckit.js as above when you can.

The audit_handoff string

Only for task: "fix", and only for the code the audit was about with every audit edit applied. The page builds both from the normalised audit reply res (recon.js normalize, below) and the analysis A of the audited paste, in recon.js fixHandoff: 

const run = Recon.applyFindings(A, res.findings, Asynckit);   // every finding's edits, in order, each on top of the last
JSON.stringify({ verdict: res.verdict, headline: res.headline,
  findings: res.findings.map(f => ({ id: f.id, severity: f.severity, file: f.file, line: f.line, title: f.title, why: f.why, edits: f.edits.length })),
  applied: /* edits that applied */, failed: /* edits that did not */ })
// run.A.text is the edited paste: it becomes code, and facts is recomputed from it

That is {"verdict", "headline", "findings": [{id, severity, file, line, title, why, edits}], "applied", "failed"}, where each finding’s edits is the number of edits it carried. applyFindings applies every finding’s edits with Asynckit.applyEdits, in the order listed: each before must occur exactly once in its file as the earlier edits left it (leading and trailing blank lines ignored), or that edit is reported as failed and skipped — it is never guessed. The handoff is a previous reply, not evidence: the model checks it against code and fixes what is left. This script does the whole step — the edited paste, its recomputed facts and the handoff string, in the same shape as build-check.js prints, so the samples read it the same way: 

// handoff.js -- run: node handoff.js quotes-paste.txt quotes-reply.txt > quotes-fix-check.json   (asynckit.js, recon.js next to it)
const fs = require("fs");
const Asynckit = require("./asynckit.js");
const Recon = require("./recon.js");
const A = Asynckit.analyze(fs.readFileSync(process.argv[2], "utf8"));          // the audited paste
const res = Recon.normalize(Recon.parseResult(fs.readFileSync(process.argv[3], "utf8")), "audit");
const ho = Recon.fixHandoff(A, res);                                            // every edit, in order
const B = Asynckit.analyze(ho.text);                                            // facts recomputed from the edited paste
const inp = Asynckit.buildInput("fix", B, "", ho.handoff);
console.log(JSON.stringify({ code: inp.code, facts: JSON.parse(inp.facts), audit_handoff: inp.audit_handoff }, null, 2));
console.error(ho.applied + " edit(s) applied, " + ho.failed + " did not apply");

Save the audit’s output.output as quotes-reply.txt; for the quotes audit below it reports 6 edit(s) applied, 0 did not apply, and the page sends that fix run with the audit’s note and the key asyncio-desk:fix:8288d555-20ff:a1.

The output contracts

The model is instructed (SKILL.md) to reply with one JSON object and nothing else — no prose, no code fences — with every array of its lane present ([] when empty). The run’s output text is that object. In both lanes it must ground everything in code: a caller, a coroutine, an event-loop setup, a shutdown hook, a timeout or a framework behaviour that is not in the paste is never claimed to exist — it goes into questions; whether an imported function is a coroutine, or blocks, is unknown unless the paste shows it. It must never write a secret value: a line that holds a literal credential is never copied into the reply (not in evidence, not in an edit, not in a file), and no credential, real hostname or endpoint is invented. It must never change what the code does for its callers: same functions and methods, names, parameters, return values on the paths that worked, and the same sync-or-async nature of every public function, unless the note asks for it. It uses asyncio.TaskGroup and asyncio.timeout only when facts.service.python_version allows them (3.11+) or the paste already uses them. Every page flag whose sev is not info is answered exactly once (audit lane: in flag_answers), and an info flag is never reported as a finding.

task: "audit"

task: "fix"

How the page reads a reply (recon.js parseResult and normalize): it strips a code fence and parses from the first { to the last }. A reply is read as the lane that was asked for, unless it names the other lane and carries that lane’s body (a files array for fix, a findings array for audit). An unknown verdict shows as needs_work or partial and counts as a disagreement; an unknown severity becomes medium; ids like AP7 or ap 7 become AP-07; flags keeps only F<n> values; findings with no file, evidence and title are dropped; service may also arrive as component, file as path, a change’s function as func and its change as what, and an open item as path; questions is capped at 10, plan at 30 and verify at 20. An audit reply carries 9 sections (verdict, headline, service, areas, findings, flag_answers, plan, questions, summary) and a fix reply 8 (verdict, headline, files, changes, verify, open, questions, summary), which is what the page counts when it recovers a partial reply.

Worked examples

Both are examples the page ships (the example buttons on the app page; the full pastes are in /example.js, ids quotes and invsync), built exactly as the page builds them: Asynckit.buildInput(lane, Asynckit.analyze(text), note, null), with the real model reply the page replays for each. The pastes are shown whole; the request bodies cut the long code and facts strings with a visible ..., and the replies are pretty-printed excerpts, with ... where entries were left out. Every value shown is copied from the input or the reply. Neither paste holds a credential; the vendor host is an invented .test name.

Audit: a quote feed that calls requests and time.sleep inside coroutines, drops its publish task and swallows cancellation

Two files, pyproject.toml (requires-python = ">=3.11") and quoteboard/feeds.py: a poller for a trading-floor quote board. fetch_quote is a coroutine that calls requests.get and backs off with time.sleep; refresh_board gathers one fetch per symbol with return_exceptions=True and writes every result into the board unchecked; run_forever starts a publish task it never keeps and wraps each cycle in except BaseException. The page’s free check raises 6 flags (3 high, 2 medium, 1 low) (plus the AP-19 context flag); its own reading of the verdict is blocked. The engineer’s note: “The quote board freezes for seconds at a time and Ctrl-C does not stop it. What do we fix before it serves the trading floor?”

The code string, whole: 1,499 characters, 51 lines ending in a newline. Save it as quotes-paste.txt and run node build-check.js quotes-paste.txt > quotes-check.json: 

# file: pyproject.toml
[project]
name = "quote-board"
version = "0.4.2"
requires-python = ">=3.11"
dependencies = ["aiohttp>=3.9", "requests>=2.31"]
---
# file: quoteboard/feeds.py
import asyncio
import logging
import time

import requests

log = logging.getLogger(__name__)

VENDOR_URL = "https://quotes.example.test/v2/last"
REFRESH_SECONDS = 15


async def fetch_quote(symbol: str) -> dict:
    for attempt in range(3):
        resp = requests.get(VENDOR_URL, params={"symbol": symbol}, timeout=10)
        if resp.status_code == 200:
            return resp.json()
        log.warning("vendor returned %s for %s", resp.status_code, symbol)
        time.sleep(2 ** attempt)
    raise RuntimeError(f"no quote for {symbol} after 3 attempts")


async def refresh_board(symbols: list[str], board: dict) -> int:
    results = await asyncio.gather(*[fetch_quote(s) for s in symbols], return_exceptions=True)
    for symbol, quote in zip(symbols, results):
        board[symbol] = quote
    return len(results)


async def publish(board: dict, channel) -> None:
    await channel.send_json(board)


async def run_forever(symbols: list[str], channel) -> None:
    board: dict = {}
    while True:
        try:
            count = await refresh_board(symbols, board)
            asyncio.create_task(publish(board, channel))
            log.info("refreshed %d symbols", count)
        except BaseException:
            log.exception("refresh failed; retrying")
        await asyncio.sleep(REFRESH_SECONDS)

Its facts, decoded (the request carries this object as one compact JSON string):

{
  "service": {
    "python_version": ">=3.11",
    "python_files": 1,
    "functions": 4,
    "coroutines": 4,
    "awaited_calls": 4,
    "tasks": 1,
    "handlers": 0
  },
  "files": [
    {
      "path": "pyproject.toml",
      "kind": "deps",
      "line": 2,
      "end_line": 6
    },
    {
      "path": "quoteboard/feeds.py",
      "kind": "python",
      "line": 9,
      "end_line": 52
    }
  ],
  "functions": [
    {
      "name": "fetch_quote",
      "file": "quoteboard/feeds.py",
      "line": 21,
      "async": true
    },
    {
      "name": "refresh_board",
      "file": "quoteboard/feeds.py",
      "line": 31,
      "async": true
    },
    {
      "name": "publish",
      "file": "quoteboard/feeds.py",
      "line": 38,
      "async": true
    },
    {
      "name": "run_forever",
      "file": "quoteboard/feeds.py",
      "line": 42,
      "async": true
    }
  ],
  "handlers": [],
  "tasks": [
    {
      "file": "quoteboard/feeds.py",
      "line": 47,
      "func": "run_forever",
      "kind": "create_task",
      "target": "publish",
      "kept": false,
      "in_loop": true
    }
  ],
  "gathers": [
    {
      "file": "quoteboard/feeds.py",
      "line": 32,
      "func": "refresh_board",
      "return_exceptions": true
    }
  ],
  "blocking_calls": [
    {
      "file": "quoteboard/feeds.py",
      "line": 23,
      "func": "fetch_quote",
      "call": "requests.get",
      "id": "AP-02"
    },
    {
      "file": "quoteboard/feeds.py",
      "line": 27,
      "func": "fetch_quote",
      "call": "time.sleep",
      "id": "AP-01"
    }
  ],
  "primitives": [],
  "cancel_catchers": [
    {
      "file": "quoteboard/feeds.py",
      "line": 49,
      "type": "BaseException",
      "raises": false,
      "in_coroutine": true
    }
  ],
  "flags": [
    {
      "uid": "F1",
      "id": "AP-02",
      "sev": "high",
      "file": "quoteboard/feeds.py",
      "line": 23,
      "text": "fetch_quote calls requests.get(): a blocking network call runs on the event loop",
      "detail": "A synchronous HTTP or socket call holds the event loop until the remote side answers: while it waits, no other coroutine runs, so one slow host stalls every request. Use an async client (httpx.AsyncClient, aiohttp) or move the call off the loop with await asyncio.to_thread(...)."
    },
    {
      "uid": "F2",
      "id": "AP-01",
      "sev": "high",
      "file": "quoteboard/feeds.py",
      "line": 27,
      "text": "fetch_quote calls time.sleep(): time.sleep() blocks the event loop",
      "detail": "time.sleep freezes the whole event loop - every other task, request and timer waits - for the full duration. Use await asyncio.sleep(...)."
    },
    {
      "uid": "F3",
      "id": "AP-07",
      "sev": "high",
      "file": "quoteboard/feeds.py",
      "line": 49,
      "text": "except BaseException in run_forever catches CancelledError and does not re-raise it",
      "detail": "When the task is cancelled (shutdown, a timeout, a TaskGroup failing) the CancelledError lands here and is swallowed: the task keeps running or returns normally, asyncio.wait_for and TaskGroup cannot finish, and shutdown hangs. Clean up and re-raise with a bare raise - or catch Exception, which does not include CancelledError."
    },
    {
      "uid": "F4",
      "id": "AP-08",
      "sev": "medium",
      "file": "quoteboard/feeds.py",
      "line": 32,
      "text": "results = await asyncio.gather(..., return_exceptions=True) is never checked for exceptions",
      "detail": "Each failed awaitable puts its exception object into results in place of a result; the code then treats exceptions as results (or counts them as successes). Split them out with isinstance(r, BaseException) and log or re-raise them."
    },
    {
      "uid": "F5",
      "id": "AP-06",
      "sev": "medium",
      "file": "quoteboard/feeds.py",
      "line": 47,
      "text": "asyncio.create_task(publish(...)) is not kept or awaited (in a loop)",
      "detail": "The event loop holds only a weak reference to a task: with no other reference it can be garbage-collected mid-flight, and an exception it raises is never seen (\"Task exception was never retrieved\"). Keep a reference (a set with add_done_callback(set.discard)), await it, or use an asyncio.TaskGroup."
    },
    {
      "uid": "F6",
      "id": "AP-15",
      "sev": "low",
      "file": "quoteboard/feeds.py",
      "line": 32,
      "text": "refresh_board starts one awaitable per item with no limit",
      "detail": "Every item becomes a concurrent request at once: 10,000 items open 10,000 connections, hit the remote rate limit and exhaust file descriptors. Bound it with an asyncio.Semaphore (async with sem: inside the coroutine) or a fixed pool of worker tasks reading an asyncio.Queue."
    },
    {
      "uid": "F7",
      "id": "AP-19",
      "sev": "info",
      "file": "quoteboard/feeds.py",
      "line": 9,
      "text": "context: 1 Python file, 4 coroutine(s) of 4 function(s), 4 awaited call(s), 1 task(s) created, 0 route handler(s), Python >=3.11",
      "detail": "Also read: pyproject.toml (deps). Only what is pasted is checked: whether an imported function is a coroutine or blocks, and how the loop is started and shut down outside the paste, is outside the check."
    }
  ],
  "verdict_candidate": "blocked",
  "notes": []
}

The request body (POST /estimate, then POST /run or /run-stream with Idempotency-Key: asyncio-desk:audit:7e5f5d89-18f5:a1 as the page sends it): 

{
  "task": "audit",
  "code": "# file: pyproject.toml\n[project]\nname = \"quote-board\"\nversion = \"0.4.2\"\nrequires-python = \">=3.11\"\ndependencies = [\"aiohttp>=3.9\", \"requests>=2.31\"]\n---\n# file: quoteboard/feeds.py\nimport asyncio\nimport logging\nimport time\n\nimport...",
  "facts": "{\"service\":{\"python_version\":\">=3.11\",\"python_files\":1,\"functions\":4,\"coroutines\":4,\"awaited_calls\":4,\"tasks\":1,\"handlers\":0},\"files\":[{\"path\":\"pyproject.toml\",\"kind\":\"de...",
  "note": "The quote board freezes for seconds at a time and Ctrl-C does not stop it. What do we fix before it serves the trading floor?"
}

The reply (output.output), an excerpt: the verdict, the headline, each area’s status, and the one finding that answers “Ctrl-C does not stop it”, with its edit and its flag answer: 

{
  "task": "audit",
  "verdict": "blocked",
  "headline": "Blocked: fetch_quote freezes the whole event loop on every vendor call and retry, and run_forever swallows the cancellation meant to stop it.",
  "areas": [
    {
      "area": "event_loop",
      "status": "broken"
    },
    {
      "area": "tasks",
      "status": "fragile"
    },
    {
      "area": "cancellation",
      "status": "broken"
    },
    {
      "area": "resources",
      "status": "sound"
    }
  ],
  "findings": [
    ...,
    {
      "id": "AP-07",
      "flags": [
        "F3"
      ],
      "file": "quoteboard/feeds.py",
      "line": 49,
      "severity": "high",
      "area": "cancellation",
      "title": "except BaseException swallows cancellation in run_forever",
      "evidence": "        except BaseException:\n            log.exception(\"refresh failed; retrying\")",
      "why": "CancelledError and KeyboardInterrupt both derive from BaseException, so this clause catches either one, logs \"refresh failed; retrying\", and lets the while True loop go straight into the next await asyncio.sleep(REFRESH_SECONDS). If the process is asked to stop - a task.cancel() from outside, or Ctrl-C delivered while this coroutine is running or awaiting - it is caught here and discarded instead of stopping run_forever, which matches the note's \"Ctrl-C does not stop it\": the loop just logs and keeps going every 15 seconds.",
      "edits": [
        {
          "before": "        except BaseException:",
          "after": "        except Exception:"
        }
      ]
    },
    ...
  ],
  "flag_answers": [
    {
      "flag": "F3",
      "status": "confirmed",
      "reason": "except BaseException in run_forever catches CancelledError without re-raising; narrowed to except Exception so cancellation propagates."
    },
    ...
  ],
  "plan": [
    ...,
    "Re-run with PYTHONASYNCIODEBUG=1 (or asyncio.run(main(), debug=True)) and confirm no slow-callback or never-awaited-coroutine warnings remain."
  ],
  "questions": [
    ...
  ],
  "summary": ...
}

The reply has 6 findings, one per flag, and confirms all 6 flags. The five with edits — requests.get moved to await asyncio.to_thread(...), time.sleep replaced by await asyncio.sleep, except BaseException narrowed to except Exception, an isinstance(quote, BaseException) check after the gather, and the publish task kept in a set with a done callback — carry 6 edits in all. The low AP-15 finding (one fetch per symbol with no limit) has no edit, because the paste does not say how many concurrent requests the vendor allows.

Fix: an inventory sync that never awaits its save, spins in its heartbeat and swallows shutdown

One file, invsync/service.py, with no pyproject, so the Python version is unknown. InventorySync.sync_once calls self.save(items) without await; heartbeat loops on while self.running: without ever awaiting and uses asyncio.get_event_loop(); run catches asyncio.CancelledError without re-raising; save is a coroutine that calls sqlite3 directly. The free check raises 5 flags (3 high, 1 medium, 1 low); its reading of the verdict is blocked. This example has no audit before it, so it carries no audit_handoff. The engineer’s note: “Items never reach the database, the heartbeat freezes everything, and the worker ignores shutdown. Fix those. Leave save() on sqlite3 exactly as it is for now - the storage team is moving it to asyncpg next sprint.”

The code string, whole: 1,844 characters, 59 lines ending in a newline. Save it as invsync-paste.txt and run node build-check.js invsync-paste.txt > invsync-check.json: 

# file: invsync/service.py
import asyncio
import logging
import sqlite3

import httpx

log = logging.getLogger(__name__)

DB_PATH = "inventory.db"


class InventorySync:
    def __init__(self, api_base: str):
        self.api_base = api_base
        self.running = True
        self.last_beat = 0.0

    async def pull_page(self, client: httpx.AsyncClient, page: int) -> list[dict]:
        resp = await client.get(f"{self.api_base}/items", params={"page": page})
        resp.raise_for_status()
        return resp.json()["items"]

    async def save(self, items: list[dict]) -> None:
        conn = sqlite3.connect(DB_PATH)
        conn.executemany("INSERT OR REPLACE INTO items (sku, qty) VALUES (:sku, :qty)", items)
        conn.commit()
        conn.close()

    async def sync_once(self, client: httpx.AsyncClient) -> int:
        page, total = 1, 0
        while True:
            items = await self.pull_page(client, page)
            if not items:
                return total
            self.save(items)
            total += len(items)
            page += 1

    async def heartbeat(self) -> None:
        loop = asyncio.get_event_loop()
        while self.running:
            if loop.time() - self.last_beat > 30:
                self.last_beat = loop.time()
                log.info("sync alive")

    async def run(self) -> None:
        async with httpx.AsyncClient(timeout=20) as client:
            beat = asyncio.create_task(self.heartbeat())
            try:
                while self.running:
                    count = await self.sync_once(client)
                    log.info("synced %d items", count)
                    await asyncio.sleep(60)
            except asyncio.CancelledError:
                log.info("sync stopped")
            finally:
                self.running = False
                beat.cancel()

Its facts, decoded, cut to files, flags and verdict_candidate (the full object also lists the 6 functions, the heartbeat task, the 3 blocking sqlite3 calls, the conn and client primitives and the one cancel catcher): 

{
  "files": [
    {
      "path": "invsync/service.py",
      "kind": "python",
      "line": 2,
      "end_line": 60
    }
  ],
  "flags": [
    {
      "uid": "F1",
      "id": "AP-05",
      "sev": "high",
      "file": "invsync/service.py",
      "line": 36,
      "text": "self.save(...) is called without await, so it never runs",
      "detail": "Calling a coroutine function only creates a coroutine object; without await (or asyncio.create_task) its body never executes and Python prints \"coroutine was never awaited\" at garbage collection. Write await self.save(...)."
    },
    {
      "uid": "F2",
      "id": "AP-10",
      "sev": "high",
      "file": "invsync/service.py",
      "line": 42,
      "text": "while self.running: in InventorySync.heartbeat never awaits, so it never gives the event loop back",
      "detail": "A coroutine only lets other tasks run at an await. This loop has none: once it starts, every other task, timer and request on the loop stops until it ends - and if it waits for a flag another task sets, it never ends. Await inside the loop (an asyncio.Event, a queue get, or at least await asyncio.sleep(...))."
    },
    {
      "uid": "F3",
      "id": "AP-07",
      "sev": "high",
      "file": "invsync/service.py",
      "line": 55,
      "text": "except asyncio.CancelledError in InventorySync.run catches CancelledError and does not re-raise it",
      "detail": "When the task is cancelled (shutdown, a timeout, a TaskGroup failing) the CancelledError lands here and is swallowed: the task keeps running or returns normally, asyncio.wait_for and TaskGroup cannot finish, and shutdown hangs. Clean up and re-raise with a bare raise - or catch Exception, which does not include CancelledError."
    },
    {
      "uid": "F4",
      "id": "AP-03",
      "sev": "medium",
      "file": "invsync/service.py",
      "line": 25,
      "text": "InventorySync.save makes 3 blocking calls (sqlite3.connect(), conn.executemany(), conn.commit()): a blocking subprocess, database or queue call runs on the event loop",
      "detail": "A synchronous subprocess, database driver or thread-queue call blocks the event loop until it returns, so every other task stalls behind it. Use the async API (asyncio.create_subprocess_exec, an async driver, asyncio.Queue) or await asyncio.to_thread(...).",
      "lines": [
        25,
        26,
        27
      ]
    },
    {
      "uid": "F5",
      "id": "AP-16",
      "sev": "low",
      "file": "invsync/service.py",
      "line": 41,
      "text": "asyncio.get_event_loop() inside the coroutine InventorySync.heartbeat",
      "detail": "Inside a coroutine the loop is always running: asyncio.get_running_loop() says so and cannot create a stray second loop. get_event_loop() is deprecated for this use."
    },
    {
      "uid": "F6",
      "id": "AP-19",
      "sev": "info",
      "file": "invsync/service.py",
      "line": 2,
      "text": "context: 1 Python file, 5 coroutine(s) of 6 function(s), 4 awaited call(s), 1 task(s) created, 0 route handler(s), Python version unknown",
      "detail": "Only what is pasted is checked: whether an imported function is a coroutine or blocks, and how the loop is started and shut down outside the paste, is outside the check."
    }
  ],
  "verdict_candidate": "blocked"
}

The request body (Idempotency-Key: asyncio-desk:fix:af0f9f05-1b00:a1): 

{
  "task": "fix",
  "code": "# file: invsync/service.py\nimport asyncio\nimport logging\nimport sqlite3\n\nimport httpx\n\nlog = logging.getLogger(__name__)\n\nDB_PATH = \"inventory.db\"\n\n\nclass InventorySync:\n    def __init__(self, api_base: str):\n        self.api_base...",
  "facts": "{\"service\":{\"python_version\":null,\"python_files\":1,\"functions\":6,\"coroutines\":5,\"awaited_calls\":4,\"tasks\":1,\"handlers\":0},\"files\":[{\"path\":\"invsync/service.py\",\"kind\":\"py...",
  "note": "Items never reach the database, the heartbeat freezes everything, and the worker ignores shutdown. Fix those. Leave save() on sqlite3 exactly as it is for now - the storage team is moving it to asyncpg next sprint."
}

The reply (output.output), an excerpt: the verdict, the headline, the end of the one returned file, the change that makes shutdown work, the last verification step and the open item: 

{
  "task": "fix",
  "verdict": "partial",
  "headline": "Awaited save() so items actually land in the database, made heartbeat yield the loop, and re-raised CancelledError so shutdown works; sqlite3 in save() left untouched per the note.",
  "files": [
    {
      "path": "invsync/service.py",
      "content": "import asyncio\nimport logging\n...\n    async def run(self) -> None:\n        async with httpx.AsyncClient(timeout=20) as client:\n            beat = asyncio.create_task(self.heartbeat())\n            try:\n                while self.running:\n                    count = await self.sync_once(client)\n                    log.info(\"synced %d items\", count)\n                    await asyncio.sleep(60)\n            except asyncio.CancelledError:\n                log.info(\"sync stopped\")\n                raise\n            finally:\n                self.running = False\n                beat.cancel()\n                try:\n                    await beat\n                except asyncio.CancelledError:\n                    pass\n"
    }
  ],
  "changes": [
    ...,
    {
      "file": "invsync/service.py",
      "function": "InventorySync.run",
      "flags": [
        "F3"
      ],
      "change": "Re-raised CancelledError after logging in the except block, and after beat.cancel() in finally, awaited beat inside a try/except CancelledError: pass.",
      "why": "Swallowing CancelledError made a shutdown request (cancelling the run() task) return normally instead of stopping the worker, so a caller using wait_for/TaskGroup or awaiting the task could never observe the cancellation; re-raising restores that signal, and awaiting the now-cancelled heartbeat task means it is cleanly reaped instead of left dangling when run() returns."
    }
  ],
  "verify": [
    ...,
    "Test: start InventorySync.run() as a task, let it reach the await asyncio.sleep(60) point, then call task.cancel() and await asyncio.wait_for(task, timeout=1); assert it raises CancelledError (not that it returns normally) and completes within the 1s timeout - this would have caught both the frozen heartbeat loop (F2) and the swallowed CancelledError (F3), since either regressing would hang or return silently instead."
  ],
  "open": [
    {
      "item": "InventorySync.save still opens a blocking sqlite3 connection and runs executemany()/commit() synchronously inside the coroutine, so every save freezes the event loop for the duration of that database write.",
      "flags": [
        "F4"
      ],
      "reason": "The engineer's note says to leave save() on sqlite3 exactly as it is for now because the storage team is moving it to asyncpg next sprint, so this is left unchanged pending that migration rather than wrapped in asyncio.to_thread as a stopgap."
    }
  ],
  "questions": [],
  "summary": ...
}

The other two changes add await before self.save(items) in InventorySync.sync_once (F1), and in InventorySync.heartbeat switch to asyncio.get_running_loop() and add await asyncio.sleep(1) at the end of the loop (F2, F5). The verdict is partial because the note asked to leave save() on sqlite3, so the medium F4 is named in open rather than fixed.

The page checks the reply against the code; the API does not

What comes back from the API is the model’s raw text in output.output. The page holds it to account in the browser before showing it (recon.js reconcile, with the facts, the code and the handoff it sent): it applies every edit or returned file to the paste and re-runs its own checks on the result. None of that happens in the API. A direct API caller gets the reply unchecked and must do the applying and re-checking itself.

recon.js also runs in Node, so you can hold a reply to exactly the page’s standard. Save /asynckit.js and /recon.js next to this script, pass the file you built the body from (build-check.js or handoff.js output), the reply text and the lane; it prints every statement, the count, and the paste with every edit (or file) put back: 

// recheck.js -- run: node recheck.js quotes-check.json quotes-reply.txt audit > quotes-edited.txt   (asynckit.js, recon.js next to it)
const fs = require("fs");
const Recon = require("./recon.js");                                            // loads ./asynckit.js itself
const sent = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));             // code, facts (and audit_handoff) you sent
const lane = process.argv[4] || "audit";
const res = Recon.normalize(Recon.parseResult(fs.readFileSync(process.argv[3], "utf8")), lane);  // output.output
const r = Recon.reconcile(res, { facts: sent.facts, code: sent.code, handoff: sent.audit_handoff || null });
r.notes.forEach((n) => console.error(n.kind + ": " + n.text));
console.error(r.disagreements + " disagreement(s) in " + r.statements + " statements checked");
if (r.after) (r.after.flags || []).forEach((f) => console.error("still raised: " + f.id + " " + f.sev + " " + f.file + ":" + f.line + " " + f.text));
if (r.after && r.after.text) console.log(r.after.text.replace(/\n$/, ""));      // the paste with every edit (or file) put back

For the quotes audit reply it reports:

ok: The areas table rates the event loop, tasks, cancellation and resources once each.
ok: Every one of the 6 findings names a pasted file, a line inside it and evidence copied from it.
ok: The verdict (blocked) fits the worst finding.
ok: Every one of the page's 6 flags is answered once.
ok: All 6 edits applied in order, each before text found exactly once.
ok: Every confirmed flag a finding carries is gone once all edits are applied.
ok: Every function of the paste is still there after the edits.
ok: The reply repeats no credential from the paste.
0 disagreement(s) in 8 statements checked
still raised: AP-15 low quoteboard/feeds.py:32 refresh_board starts one awaitable per item with no limit

and for the invsync fix reply (node recheck.js invsync-check.json invsync-reply.txt fix):

ok: 1 file returned whole.
ok: With the fixed files in place the free check raises no high or medium flag beyond the ones left open (0 low).
info: F4 left open by the reply.
ok: Every one of the 6 functions is still there.
ok: Every one of the 3 changes names a returned file, a function in the fixed code and real page flags.
ok: The verdict (partial) fits the open list.
ok: The reply repeats no credential from the paste.
0 disagreement(s) in 6 statements checked
still raised: AP-03 medium invsync/service.py:25 InventorySync.save makes 3 blocking calls (sqlite3.connect(), conn.executemany(), conn.commit()): a blocking subprocess, database or queue call runs on the event loop

The page does not run the code and is not asyncio debug mode. After that, run your tests with PYTHONASYNCIODEBUG=1 (or asyncio.run(main(), debug=True)), which logs slow callbacks and never-awaited coroutines, plus the tests the reply’s plan or verify names, before you ship anything.

Step 1 — a tiny client helper

One function per language that does what sdk.js does for every call: JSON in, bearer token if you have one, data out on a 2xx, an error carrying status, error.code and error.message otherwise. The later steps assume this helper is in the same file (for Go, Java and C#, the later snippets go inside main / the top-level statements; Java’s makeInput from step 4 goes in the class). 

BASE="https://api.skillsafe.ai/v1/app-api"
TOKEN="${SKILLSAFE_TOKEN:-YOUR_TOKEN}"   # step 2

# api METHOD PATH [extra curl args...] -- prints the whole envelope; pipe to jq
api() {
  method="$1"; path="$2"; shift 2
  curl -sS -X "$method" "$BASE$path" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $TOKEN" "$@"
}
# success: jq '.data'      failure: jq '.error | {code, message}'

Step 2 — a token

Two kinds work:

# personal token (needed for a run): copy it from /tokens.html, then
#   export SKILLSAFE_TOKEN=...        and skip the rest of this block
# guest token (enough for /me and /estimate): no Authorization header on this one call
TOKEN=$(curl -sS -X POST "$BASE/guest" \
  -H "Content-Type: application/json" \
  -d '{"slug":"asyncio-desk"}' | jq -r '.data.token')
echo "guest token: ${TOKEN:0:12}..."

Step 3 — GET /me

Who the token belongs to and what it can spend. sdk.js documents the shape as {subject_type, subject_id, credits, profile?}. The page treats the caller as signed in only when subject_type is "user", shows credits as the balance (1 credit = $0.0001, so it divides by 10 000 for the dollar figure), and compares it with the estimate in step 4 before it lets you run. 

api GET /me | jq '.data // .error'

Step 4 — build the input, then POST /estimate

First a small makeInput that does what buildInput does: task, then code as the paste the page would send, facts as a compact JSON string, the note when it is not blank, and — for the fix lane only — the audit_handoff string when the file carries one. It reads the file build-check.js (or handoff.js) printed. The samples build the audit input of the quotes example from quotes-check.json; step 6 reuses makeInput for the invsync (fix) example. Then price it. The body of /estimate is the same input you will send to /run; no job is created and nothing is charged — /estimate is free. From the response the page reads:

FieldMeaning
hold_creditsA reservation, not a price: the worst case the platform holds while the run is in flight. The page shows it as “reserves N credits ($...) for the audit run” and adds that you are charged only for what the run actually uses, usually far less. What you pay is the job’s charged_credits after settlement (step 5). A balance below the hold is allowed, but the page warns that the reply may be cut short (truncated: true).
min_creditsThe smallest balance that can start a run. Below it the page disables the run button and names the shortfall, because the call would be a 402.
sponsor_enabledWhen true, a caller who is not signed in may run; otherwise the page asks them to sign in.
warningsInput warnings. They do not refuse the call; the page shows them next to the price (“input warnings: ...”), so check them before you run.

The page re-prices whenever the paste, the note or the lane change. The amounts grow with the size of code and facts, so read them from the call rather than hard-coding them. 

# quotes-check.json: printed by build-check.js (see "The facts string").
# (.facts | tojson) turns the facts into ONE compact string, as JSON.stringify does.
BODY=$(jq -c --arg note "The quote board freezes for seconds at a time and Ctrl-C does not stop it. What do we fix before it serves the trading floor?" \
  '{task: "audit", code, facts: (.facts | tojson), note: $note}' quotes-check.json)
# No page check at hand? facts: "{}" is accepted as a string, but the reply then has no page flags to answer.
# Fix lane after an audit: read handoff.js's output instead and add its string:
#   '{task: "fix", code, facts: (.facts | tojson), note: $note} + (if .audit_handoff then {audit_handoff} else {} end)'

api POST /estimate -d "$BODY" \
  | jq '.error // (.data | {hold_credits, min_credits, sponsor_enabled, warnings})'

Step 5 — POST /run, then poll the job (audit)

Send the same input to /run with an Idempotency-Key header, using a personal token. Its data carries a job_id. Poll GET /jobs/{job_id} the way sdk.js waitForJob does: every second until status is succeeded or failed, giving up on the client side after 180 seconds. On the finished job, read:

Idempotency key. Resending a request with the same key must not start a second paid run, so derive the key from the input, not from the clock — and include the lane, so an audit and a fix run of the same paste never share a key. The page uses asyncio-desk:<lane>:<inputHash>:a<attempt> (app.js run), where <lane> is audit or fix, <inputHash> is a 32-bit djb2 hash of JSON.stringify(input) in hex, a dash, and the string’s length in hex (app.js inputHash, over the input without retry_note), and <attempt> is 1 for a normal run and 2 for the automatic reformat retry (which also adds retry_note). For the two worked examples that is asyncio-desk:audit:7e5f5d89-18f5:a1 (quotes audit) and asyncio-desk:fix:af0f9f05-1b00:a1 (invsync fix); the fix run of the quotes audit handed on (below) is asyncio-desk:fix:8288d555-20ff:a1. The format is the page’s convention, not a requirement: any stable, unique string does. The samples below use the lane and a SHA-256 prefix.

The page itself uses /run-stream (step 6), not /run; both take the same body and header. 

KEY="asyncio-desk:audit:$(printf '%s' "$BODY" | shasum -a 256 | cut -c1-16):a1"

JOB=$(api POST /run -H "Idempotency-Key: $KEY" -d "$BODY" | jq -r '.data.job_id')

for i in $(seq 180); do                       # 1 s interval, 180 s client-side limit
  J=$(api GET "/jobs/$JOB")
  S=$(printf '%s' "$J" | jq -r '.data.status')
  if [ "$S" = "succeeded" ] || [ "$S" = "failed" ]; then break; fi
  sleep 1
done

printf '%s' "$J" | jq '.data | {status, truncated, charged_credits, error}'
printf '%s' "$J" | jq -r '.data.output.output' \
  | jq '{verdict, headline, areas: [(.areas // [])[] | {area, status}],
         findings: [(.findings // [])[] | {id, file, line, severity, edits: ((.edits // []) | length)}],
         flag_answers: [(.flag_answers // [])[] | {flag, status}]}'

Step 6 — POST /run-stream (Server-Sent Events, fix)

The alternative to step 5, and what the page uses: same kind of body, same Idempotency-Key header, one request. Run one or the other for a given input, not both. To show the second lane, the samples build the fix input of the invsync example (with its own key) and stream it; to stream the audit input instead, pass the step 4 input and key. The response is text/event-stream. sdk.js splits it into frames on a blank line, takes the event name from an event: line (default message) and concatenates the data: lines, skips frames with no data or with data that is not JSON, and handles these events:

EventDataWhat the SDK does
delta{text}Passes text to onDelta.
jobjob infoPasses it to onJob (the page uses it to advance its progress display).
donethe final payload: {job_id, status, charged_credits, output}Keeps it as the result.
pendinga payloadTreated exactly like done. If it carries a job_id and no output, poll that job as in step 5.
error{message, code, job_id}After the stream ends, raises an error with those fields.

If the response is not text/event-stream, it is an ordinary JSON envelope: the SDK returns its data (an idempotent replay returns this way) or raises the error on a non-2xx status. Handle both shapes.

From the final payload the page reads output.output (falling back to the concatenated delta text), truncated and charged_credits. Browsers receive progress ticks rather than deltas from this endpoint, so the page relies on the final payload; if the stream fails part-way, it tries to recover a partial reply from whatever delta text arrived. The samples print the verdict and headline, each returned file’s path and size, each change (function, flags and change), each verification step, each open item and each question. To put the files into the paste and re-check them the way the page’s “Put every file into the paste” does, keep the reply text and run recheck.js with the lane fix. To fix code you audited, read handoff.js’s output instead of invsync-check.json: makeInput then carries its audit_handoff. 

# the fix worked example: invsync-check.json from build-check.js
# (for audited code, read handoff.js's output instead; the + (...) adds its audit_handoff)
FBODY=$(jq -c --arg note "Items never reach the database, the heartbeat freezes everything, and the worker ignores shutdown. Fix those. Leave save() on sqlite3 exactly as it is for now - the storage team is moving it to asyncpg next sprint." \
  '{task: "fix", code, facts: (.facts | tojson), note: $note} + (if .audit_handoff then {audit_handoff} else {} end)' \
  invsync-check.json)
FKEY="asyncio-desk:fix:$(printf '%s' "$FBODY" | shasum -a 256 | cut -c1-16):a1"

# -N turns off buffering; the whole stream lands in $STREAM
STREAM=$(api POST /run-stream -N -H "Idempotency-Key: $FKEY" -d "$FBODY")

# frames look like:
#   event: job
#   data: {...}
#
#   event: done
#   data: {"job_id":"...","status":"...","charged_credits":...,"output":{"output":"{\"task\":\"fix\",...}"}}

# the final reply text, from the done (or pending) frame:
REPLY=$(printf '%s\n' "$STREAM" \
  | awk '/^event:/{ev=$2} /^data:/ && (ev=="done" || ev=="pending"){sub(/^data: */,""); print}' \
  | jq -r '.output.output')
# an idempotent replay answers with a plain JSON envelope instead: REPLY=$(printf '%s' "$STREAM" | jq -r '.data.output.output')
printf '%s' "$REPLY" | jq '{verdict, headline,
  files: [(.files // [])[] | {path, characters: (.content | length)}],
  changes: [(.changes // [])[] | {function, flags, change}], verify, open, questions}'

What the page does that you now do

Or skip all of this and use Asyncio Desk in the browser: the check, the flags, the blocking-call, task, primitive and cancel-catcher inventories, putting an edit or the fixed files back into the paste, and the Markdown and CSV exports are free.